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Abstract — We descnbe how to achieve optimal entangle- 
ment generation and one-way entanglement distillation rates 
by coherent implementation of a class of secret key generation 
and secret key distillation protocols, respectively. 

Quantum information theory may be understood in 
terms of inter-conversion between various resources 0. 
One very desirable resource is a maximally entangled 

] state shared between two parties (Alice and Bob). It 
allows them to perform various tasks such as teleporta- 
tion, super-dense coding, etc. Q. Another is a pair of 
maximally correlated classical bit-strings shared by the 
two parties, reliably secret from any third party (Eve). It 
has important cryptographic applications since it can be 
used as a secret key (or "one time pad" ) allowing Alice 
and Bob private communication over a public channel. 

' Although used for different purposes, the two resources 
are intimately related through the property of "exclu- 

] siveness" — in the one case toward the total outside 
world, in the other toward the eavesdropper Eve. This 

[ connection has been confirmed by a growing literature 
of useful analogies |^ [l9j and operational equivalences 

! Q, 1^ . In this Letter we further exploit this connection 
to relate several private and quantum protocols, culmi- 

[ nating in the demonstration of the "hashing inequality" 
for one-way entanglement distillation 0|. We con- 

' sider four distinct resource conversion scenarios, starting 
from a noisy quantum channel/entanglement and ending 
up with near-perfect secret key /entanglement. In other 
words we are converting a noisy dynamic/static quantum 
resource into a noiseless static private/quantum resource. 

1. static — > private = Secret key distillation. The task 
is to convert n copies of the bipartite state p^^ shared 
between Alice and Bob into nR bits of secret key using 
1-LOPC (local quantum operations and forward public 
communication). The quantity R is referred to as the 
rate of the protocol. To understand what is meant by 
a secret key, consider a purification ip^-^-^ — {ip]^^ ^ 
of p"^^ and allow for the worst case scenario in which 
the eavesdropper Eve is given the purifying system E. 
Defining $ = i(|00)(00| + |11)(11|), a pair of maximally 
correlated bits written formally as a density operator, the 

AB 

desired shared secret key is represented as (<& ) (g) 
6^; the classical key shared between Alice and Bob is 
decoupled from Eve's state 9. 

2. static quantum = Entanglement distillation. Here, 
by 1-LOCC (local quantum operations and forward clas- 



sical communication) (p^^)"*" ig to be converted into nR 
bits of entanglement where |$+) = ^(|00) + |11)). 

Since the final state is pure, the decoupling from E is 
implicit. Including E in the description, the effect of the 
protocol may be written as (^^■BB^'^" ^^ab-^'^'^i^ ^ 
6^ , which is just a coherent version of its private coun- 
terpart above! 

3. dynamic — > private = Secret key generation. Here the 
starting point is a noisy quantum channel J\f, a cptp map 
taking density operators in the Hilbert space of Alice's 
system A' to that of Bob's B. Applying Af is equiva- 
lent to an isometric mapping onto a larger Hilbert space 
corresponding to BE, which includes the environment E 
assumed at Eve's disposal. The channel may be charac- 
terized by its effect on some bipartite pure state \tp')^^ , 
living entirely on Alice's side, which now becomes the 
mixed state p^^ — (1'^ ® N)il'' shared between her and 
Bob. Note that the purifying system for is precisely 
E, so that we again have the tripartite state tjj^^^ . The 
task is, by Alice choosing an appropriate input to A/"**" 
and Bob performing a decoding operation, to generate 
nR bits of secret key, decoupled from E as in the first 
scenario. 

4. dynamic — > quantum = Entanglement generation. 
The channel TV is now used to generate nR bits of en- 
tanglement. Again one may explicitly include E to stress 
the resemblance to the private scenario. 

We shall show how a particular asymptotic rate R de- 
fined in terms of the state ^^-^^ may be achieved for 
the four scenarios, by which we mean that for sufficiently 
large n there exists a protocol whose output approxi- 
mates the desired state arbitrarily closely (in trace dis- 
tance). First we give a simple dimension counting ar- 
gument for secret key generation, and show how to aug- 
ment it to work for secret key distillation. Then we mod- 
ify the two protocols to make them "coherent" , yielding 
the entanglement generation and distillation protocols, 
respectively. Finally, we point to a more direct connec- 
tion between the two coherent protocols and discuss the 
implications of our results for finding optimal rates. A 
rigorous treatment of the dynamic and static scenarios 
via random code selection may be found in Q and [lo| . 
respectively, building on results from classical informa- 
tion theory Q. 

The state ip^^-^, related to our coherent protocols, 
may be written in the Schmidt representation with re- 
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spect to the A\BE partition as 

I i\ABE 



In the dynamic scenario it comes about by sending some 
l^/i)^^ = y/P{x)\x)^ ® Wx)^ through the channel. 
Relevant to our private protocols is the "decohered" state 



■ABE 



■P{x)\x) 



iBE 



(1) 



obtainable from j-!/;)"*^^ by measurement in the {\x)\ 
basis. It represents the state of a cqq system XBE [sj, 
X being a random variable with probability distribution 
P{x). In the dynamic scenario it arises from sending the 

ensemble \4''x)^ } through the channel. 

Define uo = if) — -0^ and <t = ip — -0^. For a 
quantum state p we denote the von Neumann entropy 
H{p) — — Trplogp, and the Shannon entropy of a ran- 
dom variable X, H{X) = - Ex -^(2^) log -PC^^)- If the 

state is the reduced state of a multi-party state, like the 
j^j^ 

ip above, we write H{A) = H('4) ), etc. In the par- 



ticular case of obviously Hl^ip ) = H{X). For a 
general bipartite state on AB define the conditional en- 
tropy H{A\B) = H{AB) - H{B) and quantum mutual 
information 

I{A; B) = H{A) + H{B) - H{AB). 

The latter for the cqq state in ^ is easily checked to be 
equal to the Holevo information H{uj) — P{x)H{(j)^) 
for which we shall use the notation I{X;B). As 
a rule, information theoretical quantities involving X 

are implicitly referring to ip , and those involving 
A to ^^^^ . For instance, the coherent information 
Ic{A)B) = -H{A\B) [3 refers to 0^^^, but may be 
written as H{B) - H{E) = I{X- B) - I{X\ E) when re- 
ferring to . The protocols we are about to describe 
will all achieve the rate R = Ic{A)B). In the entangle- 
ment distillation scenario this is known as the "hashing 
inequality" |1E1- 

Typicality. Let us review the properties of typical se- 
quences and subspaces. For the random variable X, any 
e, (5 > and sufficiently large n there exists a typical set 
g consisting of sequences x" = X1X2 . . . a;„ of length n 
such that 

2n[HiX)-S] ^ g\ < 2"['f^(^)+'5] 

and Pr{X" S 5} ^ 1 ~ Typical sequences are 
those in which the fraction of a given letter x is approxi- 
mated by its probability P{x), and the law of large num- 
bers guarantees that such sequences will occur with high 
probability. In less formal notation, large n will be im- 
plicit, the typical set denoted by Tx, H{X) ± S written 
as H{X)^ and 1 — e as « 1. 



The quantum analogue of the typical set is the typical 
suhspace llTl Tb of the Hilbert space 7i|", defined for 
the quantum system B in the state lo. It satisfies 



2«^(^)" < dimTs < 2"^(^)^ 

is approximately supported on Tb in the sense 
(in trace distance) with lis the 



and w®" 

that nBtj®"ns « 
projector onto Tb- 

For a cq system XB and a particular sequence G Tx 
there exists a conditionally typical suhspace Tg|x(a;") on 
which (/)^„ — (j)^. is approximately supported, such 
that 

2nH(B\x)- < dimTsixla:") < 2"^(^l^)^ 

Another important fact is that the Tb\x{x^) can be 
thought of as being approximately contained in Tb in the 
sense that 'Rb^b\x{x"')^b enjoys the same asymptotic 
properties as IiB\x{x^)- 

HSW codes. An HSW code C associated with the 
Alice-Bob cq system XB is a subset of Tx such that 
the states {iIJx")x"gC can be distinguished with proba- 
bility « 1. Intuitively, the ip^n, supported on the re- 
spective TB|x(a;") of dimension at most 2"^(^l"^) , can 
be "packed" into Tg of dimension at least 2"^^^^ with 
negfigible overlap if we take \C\ = 2"^(^'^' (Fig- !)■ 
The HSW theorem confirms this geometric picture. 



HSW CODE 




FIG. 



1: An HSW code. The arrows represent the map x" 



Privacy amplification sets. Privacy amplification 
(PA) sets are, in a sense, dual to HSW codes. A pri- 
vacy amplification set 5, associated with the Alice-Eve 
cq system XE, is a subset of Tx of size S such that 



(gin 



(2) 



x-^&S 



Evidently S — Tx is a valid PA set, but we are interested 
in making S as small as possible. Since cr'*" and (t)^n 
are "almost" uniformly supported on Te and Te|x(2;"), 
respectively, satisfying Q amounts to "covering" Te, of 
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dimension at most 2"^(^'^ with the Te\x{x''), a;" G 5, 

each of which has dimension at least 2"^^^!'''-^ (Fig. 
2). It can be shown (using techniques from Q) that 
the quotient of these dimensions, S — 2"^("^^^)^, indeed 
suffices. 



PA SET 




FIG. 2: A privacy amplification set. The arrows represent the 
map x" I— > cj>x" ■ 

Key generation (3.). We have seen that randomizing 
over the members of the PA set leaves Eve with a state 
essentially independent of the choice of S. The key gen- 
eration strategy is now clear. Construct an HSW code 
(m"")™,^, m = 1, . . . M, M = 2"-"^ , s = 1, . . . 5, of size 
MS = 2"-f(^^-«)" such that each 5™ = (u™"% is a PA 
set. The key generation code is such a partitioned HSW 
code (Fig. 3). Ahce sends the ensemble {^g, ^ X^s 4'' u"" } 
through the channel, resulting in the cq state 



-ABE 



-E 



m)(?T!,| (g) 



IE' 



BE 



Bob measures his system to find out m and Eve is left 
with the state « tr^" independent of the index m. 

Key distillation (1.). The geometric idea (Fig. 3) is 
to cover the space Tx of dimension at most 2"^^'^) with 
L = 2"-f^(-^l'^)^ key generation codes Ci ^ (m'™'')™,^ of 

size at least 2"'^(^'-^)". Ahce converts i)^^^ into i)^^^ 
for all n copies by measurement in the {\x)} basis. The 
measurement outcome with probability « I lies in 
Tx- Due to the covering, lies in some key generation 
code labeled by I. Alice sends the "which key genera- 
tion code" information I (this requires nI{X\B)'^ bits), 

leaves the overall system in the state ^' 0| and Bob 
simply proceeds as in key generation. The extra classical 
communication thus compensates for the initial resource 
being static rather than dynamic. 

We now show how the two private protocols can be 
made coherent. 

Entanglement generation (4--)- For entanglement gen- 

\m)^ ® \ fm)^ , the quan- 



eration Alice prepares ^= ^ 
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FIG. 3: A secret key generation code (left) viewed as a build- 
ing block for a key distillation code (right). 



turn code (Ivm))^ being defined by 
Upon applying the channel this becomes 



I* 



ABE 



^BE 



(3) 



(4) 



The remainder of the protocol consists of Bob decoding 
operation. He performs the measurement of ms coher- 
ently by appending a register B' in a standard state |0), 
performing a unitary operation that places the measure- 
ment "outcome" ms into B' and swapping the contents 
of B and B' . Since the original measurement yielded the 
correct value of ms with probability w 1, the coherent 
measurement can be constructed to output an approxi- 
mation of 



1 



^Ei 



\ms)^\4>ur. 



This can be rewritten as 

1 ,A 



^E 



to) ® \m) 1 0m) 



B'E 



^B'E 



where 



(5) 



B'^E 



Observe that (j>^ k, by Uhlmann's theorem their pu- 
rifications are related as \(j)m) ~ (Kn ® '^)\<t'e) for some 
unitary operator Vm- Performing the controlled unitary 
V — |to)(to| ® Vm on the system BB' finally decou- 
ples Eve, yielding 

1 



'M 



E 



Ito)"* ® |to)^| 



,B'E 



The above protocol may be modified into an entangle- 
ment transmission one in which case Alice encodes 



a quantum state via \^Pm){'m\ 
term "quantum code" for {\ipm))m 



Hence our use of the 
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Entanglement distillation (2.). We now turn to the 
construction of a coherent version of the key distillation 
protocol. To each classical set C/ corresponds a quantum 
operator A; = X^ms In lieu of a complete von 

Neumann measurement on Alice performs a much less 
intrusive one composed of the A/ (there is also a "failure" 
outcome that happens with probability « 0), revealing a 
particular value of I which is communicated to Bob using 
nH{X\B)'^ bits. Their joint state becomes 



I* 



ABE 



'M 



El 



.BE 



which differs from only in that |m) is replaced by 
\ms) . As before, Bob performs the coherent measure- 
ment, resulting in the analogue of |SJl: 



1 



^E 



,B'E 



To dispose of Alice's s-register in a coherent way fur- 
ther classical communication is necessary. Alice per- 
forms a measurement in the Fourier-transformed basis 
\i) = -^^f^^e2"'**/^|s) (< = l,...,S), and commu- 
nicates the result t to Bob using nI{X;E)^ bits, who 
then applies the phase shift J2s=i e^''*'**/'^|s)(s| to the s- 
component of his B register. This yields precisely (jSJ and 
the rest of the protocol follows the entanglement genera- 
tion one above. 

It is possible to make a more direct connection between 
entanglement distillation and the quantum codes used 
for entanglement generation. Observe that the quan- 
tum code Q could have equally well been substituted 
by {\(t>it7n))m for any t = 1, . . . , 5, Z = 1, . . . , L, where 



1 \ ^ 2 

7^E^ 



2iTist/S\ 



The sets (|0ztm))t„ and i\4'u'"-=))ms ^"^^ (mutually unbi- 
ased) bases for the same space Qi. The Qi are, in turn, 
a covering of iy®"(rA), W = J2x \(t^^){xl since the Ci 
are a covering of Tx- In other words, W^^{Ta) is cov- 
ered by quantum codes in much the same way that Tx 
is covered by key generation codes. Our entanglement 
distillation protocol may be viewed as Alice collapsing 
her space onto some quantum code via a measurement, 
sending I{A; E)^ bits of "which code" information to 
Bob, and Bob decoding as in entanglement generation. 
This view is very similar to the approach pursued by the 
Horodeckis [l^ . the difference lying in our using "ran- 
dom CSS codes" rather than random subspace ones 

In conclusion, we have seen that all four scenarios al- 
low an asymptotic conversion rate R = Ic{A)B), the 
latter referring to the state p^^ which is cither given 
(static case), or can be created by an application of the 



channel (dynamic case). In fact, the optimal rates for 
the coherent scenarios are also given in terms of Ic, but 
applied to an a ppropr iately blocked and preprocessed 
state/channel [R liollisj . The same is true for the private 
scenarios with Ic{A)B) replaced by the possibly larger 
I{X;A) — I{X;B) [22|. It remains an open question 
whether coherent (quantum) and private information are 
fully equivalent within our model. 
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